Ivanti Patches Critical SQL Injection Flaw Allowing Remote Code Execution Without Login

Ivanti has released November 2026 security updates for Endpoint Manager (EPM), Endpoint Manager Mobile (EPMM), Sentry, Cloud Services Application (CSA), and User Workspace Manager (UWM). The flaws expose systems to remote code execution, certificate changes, data theft, and service disruption. Critical EPM and CSA vulnerabilities require immediate attention.

Ivanti said the issues came through responsible disclosure, with no known customer exploitation before publication. However, services reachable without authentication remain urgent patching targets. Endpoint Manager SQL injection vulnerabilities demonstrate the risks facing management infrastructure.

Ivanti SQL Injection Flaw

The most severe flaw, CVE-2026-121653, scores 9.8 and allows remote, unauthenticated attackers to execute code through SQL injection in EPM Core before 2024 SU8. CVE-2026-18128, rated 6.8, exposes sensitive agent information in cleartext, allowing attackers between communicating systems to read or modify HTTP traffic. Both affect EPM 2024 SU7 and earlier; SU8 is available through the Ivanti License System.

CSA’s CVE-2026-121683 scores 9.4. Missing authentication allows remote attackers to add or delete arbitrary trusted EPM Core certificate entries. Only version 5.0.8 is affected; 5.0.7 and earlier are unaffected. The supplied CSA advisory identifies 5.0.8.1 as the fix.

Following Ivanti’s dual network interface guidance limits exposure to the internal interface, preventing external exploitation. Patching remains necessary. These certificate changes differ from earlier CSA authentication and injection flaws .

The EPMM advisory lists six vulnerabilities. CVE-2026-105425, rated 7.2, enables remote administrators to execute code through operating system command injection. It also affects Sentry, requiring separate updates across both products.

CVE-2026-105426 lets remote administrators set Linux kernel parameters as root; CVE-2026-105427 permanently disables Apache HTTPS services. CVE-2026-107404 enables arbitrary file deletion, while CVE-2026-83528 exposes GDPR-protected personal information.

These issues require administrator access. Authenticated local attackers can trigger a denial of service through CVE-2026-107405. Fixed EPMM releases are 12.11.0.0, 12.10.0.1, and 12.9.0.3.

Sentry also fixes CVE-2026-105669, an argument injection flaw that lets remote administrators execute existing disk binaries. CVE-2026-123179 lets local authenticated attackers disrupt service through the Tomcat shutdown listener. CVE-2026-123181 permits remote administrators to create arbitrary files and directories as root. Fixed releases include 11.0.0, 10.8.3, and 10.7.4.

UWM fixes CVE-2026-105813, a medium-severity cleartext storage flaw allowing local authenticated attackers to retrieve another local user’s session. Customers should install UWM 2026.4 through Ivanti’s licensing system.

Security teams should prioritize unauthenticated EPM and CSA exposure, then patch remaining deployments according to access and risk. Earlier EPMM and Sentry updates addressed separate vulnerabilities. Ivanti supplied no vulnerability-specific compromise indicators because public exploitation is unknown. Verify installed versions after updating; restricted administrator access does not replace patches.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs:

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Criminal IP Launches New TI Feed App on Splunkbase for Automated Threat Detection

Fortinet2Shell Vulnerability Lets Hackers Execute Code on FortiClient Systems Through Malicious Websites

N-able Warns of Critical N-central Zero-Day Vulnerability Actively Exploited by Hackers

BluePhishing Attack Abuses Microsoft Entra OAuth Consent to Create Hidden AI Agent Identities

Windows Active Directory RCE and DoS Vulnerabilities Put Windows Systems at Risk

Researchers Uncover 45 AI Hacking Frameworks, With Hundreds of Attack Consoles Exposed on the Internet